Ghostjacking: AI Agents Turn Security Logs into Attack Vectors Researchers at Tenet Security unveiled a new attack technique called Ghostjacking at DEF CON 34, exposing a critical flaw in AI-driven security workflows. The method exploits trusted operational data such as blocked web requests, monitoring alerts, and error logs to manipulate AI agents into executing malicious actions within enterprise environments. The attack leverages architectural vulnerabilities in AI systems, where agents interpret attacker-controlled content in logs as legitimate instructions rather than untrusted evidence. In a demonstrated scenario involving Cloudflare, a blocked malicious request was logged, then processed by an AI assistant. The agent, misled by embedded attacker text, modified DNS records to redirect traffic to attacker-controlled infrastructure all while appearing as an authorized API call from a trusted identity. Testing against Cloudflare’s recommended configuration revealed a 90% success rate with Claude Code. The consequences extend beyond traditional firewall bypasses: attackers gain control over DNS, email routing, and cloud credentials, enabling account takeovers without triggering conventional security alerts. Similar attack chains were demonstrated with Datadog and Sentry, where AI agents were tricked into executing commands or propagating malicious remediations across systems. The kill chain includes privilege escalation, credential theft, and persistence via agent configuration changes. Tenet also disclosed a sandbox-escape vulnerability in Claude Desktop, which Anthropic patched prior to the presentation. The findings highlight a broader "confused deputy" problem in AI systems, where agents granted high-level access to observability, ticketing, and cloud management tools fail to distinguish between data and hidden instructions. Traditional security tools like EDR, WAFs, and IAM systems may overlook these attacks, as they appear as valid actions by authorized identities. The research underscores the need for stricter controls, including isolating read-only investigations from write operations, enforcing human approval for high-impact changes, and treating all externally influenced logs as untrusted input. Without these measures, AI agents risk becoming unwitting conduits for privilege escalation and lateral movement.